diff mbox series

drm/msm/dpu: Fix bit-shifting UB in DPU_HW_VER() macro

Message ID 20230306090633.65918-1-geert+renesas@glider.be (mailing list archive)
State New, archived
Headers show
Series drm/msm/dpu: Fix bit-shifting UB in DPU_HW_VER() macro | expand

Commit Message

Geert Uytterhoeven March 6, 2023, 9:06 a.m. UTC
With gcc-5 and CONFIG_UBSAN_SHIFT=y:

    drivers/gpu/drm/msm/msm_mdss.c: In function 'msm_mdss_enable':
    drivers/gpu/drm/msm/msm_mdss.c:296:2: error: case label does not reduce to an integer constant
      case DPU_HW_VER_800:
      ^
    drivers/gpu/drm/msm/msm_mdss.c:299:2: error: case label does not reduce to an integer constant
      case DPU_HW_VER_810:
      ^
    drivers/gpu/drm/msm/msm_mdss.c:300:2: error: case label does not reduce to an integer constant
      case DPU_HW_VER_900:
      ^

This happens because for major revisions 8 or greather, the non-sign bit
of the major revision number is shifted into bit 31 of a signed integer,
which is undefined behavior.

Fix this by casting the major revision number to unsigned int.

Fixes: efcd0107727c4f04 ("drm/msm/dpu: add support for SM8550")
Fixes: 4a352c2fc15aec1e ("drm/msm/dpu: Introduce SC8280XP")
Fixes: 100d7ef6995d1f86 ("drm/msm/dpu: add support for SM8450")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Comments

Randy Dunlap March 21, 2023, 3:08 p.m. UTC | #1
On 3/6/23 01:06, Geert Uytterhoeven wrote:
> With gcc-5 and CONFIG_UBSAN_SHIFT=y:
> 
>     drivers/gpu/drm/msm/msm_mdss.c: In function 'msm_mdss_enable':
>     drivers/gpu/drm/msm/msm_mdss.c:296:2: error: case label does not reduce to an integer constant
>       case DPU_HW_VER_800:
>       ^
>     drivers/gpu/drm/msm/msm_mdss.c:299:2: error: case label does not reduce to an integer constant
>       case DPU_HW_VER_810:
>       ^
>     drivers/gpu/drm/msm/msm_mdss.c:300:2: error: case label does not reduce to an integer constant
>       case DPU_HW_VER_900:
>       ^
> 
> This happens because for major revisions 8 or greather, the non-sign bit
> of the major revision number is shifted into bit 31 of a signed integer,
> which is undefined behavior.
> 
> Fix this by casting the major revision number to unsigned int.
> 
> Fixes: efcd0107727c4f04 ("drm/msm/dpu: add support for SM8550")
> Fixes: 4a352c2fc15aec1e ("drm/msm/dpu: Introduce SC8280XP")
> Fixes: 100d7ef6995d1f86 ("drm/msm/dpu: add support for SM8450")
> Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>

Reviewed-by: Randy Dunlap <rdunlap@infradead.org>

Thanks.

> ---
>  drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
> index ddab9caebb18c40d..bbd3cbdd77956c5d 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
> @@ -19,8 +19,9 @@
>   */
>  #define MAX_BLOCKS    12
>  
> -#define DPU_HW_VER(MAJOR, MINOR, STEP) (((MAJOR & 0xF) << 28)    |\
> -		((MINOR & 0xFFF) << 16)  |\
> +#define DPU_HW_VER(MAJOR, MINOR, STEP)			\
> +		((((unsigned int)MAJOR & 0xF) << 28) |	\
> +		((MINOR & 0xFFF) << 16) |		\
>  		(STEP & 0xFFFF))
>  
>  #define DPU_HW_MAJOR(rev)		((rev) >> 28)
Rob Clark March 22, 2023, 8:48 p.m. UTC | #2
On Tue, Mar 21, 2023 at 8:08 AM Randy Dunlap <rdunlap@infradead.org> wrote:
>
>
>
> On 3/6/23 01:06, Geert Uytterhoeven wrote:
> > With gcc-5 and CONFIG_UBSAN_SHIFT=y:
> >
> >     drivers/gpu/drm/msm/msm_mdss.c: In function 'msm_mdss_enable':
> >     drivers/gpu/drm/msm/msm_mdss.c:296:2: error: case label does not reduce to an integer constant
> >       case DPU_HW_VER_800:
> >       ^
> >     drivers/gpu/drm/msm/msm_mdss.c:299:2: error: case label does not reduce to an integer constant
> >       case DPU_HW_VER_810:
> >       ^
> >     drivers/gpu/drm/msm/msm_mdss.c:300:2: error: case label does not reduce to an integer constant
> >       case DPU_HW_VER_900:
> >       ^
> >
> > This happens because for major revisions 8 or greather, the non-sign bit
> > of the major revision number is shifted into bit 31 of a signed integer,
> > which is undefined behavior.
> >
> > Fix this by casting the major revision number to unsigned int.
> >
> > Fixes: efcd0107727c4f04 ("drm/msm/dpu: add support for SM8550")
> > Fixes: 4a352c2fc15aec1e ("drm/msm/dpu: Introduce SC8280XP")
> > Fixes: 100d7ef6995d1f86 ("drm/msm/dpu: add support for SM8450")
> > Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
>
> Reviewed-by: Randy Dunlap <rdunlap@infradead.org>

Reviewed-by: Rob Clark <robdclark@gmail.com>

>
> Thanks.
>
> > ---
> >  drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 5 +++--
> >  1 file changed, 3 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
> > index ddab9caebb18c40d..bbd3cbdd77956c5d 100644
> > --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
> > +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
> > @@ -19,8 +19,9 @@
> >   */
> >  #define MAX_BLOCKS    12
> >
> > -#define DPU_HW_VER(MAJOR, MINOR, STEP) (((MAJOR & 0xF) << 28)    |\
> > -             ((MINOR & 0xFFF) << 16)  |\
> > +#define DPU_HW_VER(MAJOR, MINOR, STEP)                       \
> > +             ((((unsigned int)MAJOR & 0xF) << 28) |  \
> > +             ((MINOR & 0xFFF) << 16) |               \
> >               (STEP & 0xFFFF))
> >
> >  #define DPU_HW_MAJOR(rev)            ((rev) >> 28)
>
> --
> ~Randy
Dmitry Baryshkov March 28, 2023, 10:37 p.m. UTC | #3
On Mon, 06 Mar 2023 10:06:33 +0100, Geert Uytterhoeven wrote:
> With gcc-5 and CONFIG_UBSAN_SHIFT=y:
> 
>     drivers/gpu/drm/msm/msm_mdss.c: In function 'msm_mdss_enable':
>     drivers/gpu/drm/msm/msm_mdss.c:296:2: error: case label does not reduce to an integer constant
>       case DPU_HW_VER_800:
>       ^
>     drivers/gpu/drm/msm/msm_mdss.c:299:2: error: case label does not reduce to an integer constant
>       case DPU_HW_VER_810:
>       ^
>     drivers/gpu/drm/msm/msm_mdss.c:300:2: error: case label does not reduce to an integer constant
>       case DPU_HW_VER_900:
>       ^
> 
> [...]

Applied, thanks!

[1/1] drm/msm/dpu: Fix bit-shifting UB in DPU_HW_VER() macro
      https://gitlab.freedesktop.org/lumag/msm/-/commit/c8f370bde5b9

Best regards,
diff mbox series

Patch

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
index ddab9caebb18c40d..bbd3cbdd77956c5d 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
@@ -19,8 +19,9 @@ 
  */
 #define MAX_BLOCKS    12
 
-#define DPU_HW_VER(MAJOR, MINOR, STEP) (((MAJOR & 0xF) << 28)    |\
-		((MINOR & 0xFFF) << 16)  |\
+#define DPU_HW_VER(MAJOR, MINOR, STEP)			\
+		((((unsigned int)MAJOR & 0xF) << 28) |	\
+		((MINOR & 0xFFF) << 16) |		\
 		(STEP & 0xFFFF))
 
 #define DPU_HW_MAJOR(rev)		((rev) >> 28)